CVE-2026-66672

Unauthenticated PHP Object Injection in Flatastic = 2.0 versions...

CVE-2026-66673

Unauthenticated Cross Site Scripting XSS in Flatastic = 2.0 versions...

CVE-2026-66673

Unauthenticated Cross Site Scripting XSS in Flatastic = 2.0 versions...

EUVD-2026-63304

Unauthenticated Cross Site Scripting XSS in Flatastic = 2.0 versions...

CVE-2026-66673 WordPress Flatastic theme <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Flatastic = 2.0 versions...

CVE-2026-66672 WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Flatastic = 2.0 versions...

CVE-2026-66672

The WordPress Flatastic theme (versions ≤ 2.0) is vulnerable to unauthenticated PHP Object Injection, exploitable over the network without credentials. The Patchstack advisory documents the issue; no exploit code or in-the-wild activity is reported. Affected sites should update to a patched theme...

EUVD-2026-63303

Unauthenticated PHP Object Injection in Flatastic = 2.0 versions...

Flatastic: Die WG-App - Customized SSL, Dangerous filesystem permissions, MIT license vulnerabilities

HackApp vulnerability scanner discovered that application Flatastic: Die WG-App published at the 'play' market has multiple vulnerabilities...